Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access(CVE-2024-9926)

概要

Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

参照URL

advisory github.com
advisory nvd.nist.gov
report wpscan.com